Re: [PATCH bpf-next 13/18] selftests/bpf: Add verifier tests for stack argument validation

Yonghong Song
2026-04-25T05:33:15Z

On 4/24/26 10:48 AM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/tools/testing/selftests/bpf/progs/verifier_stack_arg.c b/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
>> new file mode 100644
>> index 000000000000..6b596ad63774
>> --- /dev/null
>> +++ b/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
>> @@ -0,0 +1,456 @@
> [ ... ]
>
>> +SEC("tc")
>> +__description("stack_arg: pruning with different stack arg types")
>> +__failure
>> +__flag(BPF_F_TEST_STATE_FREQ)
>> +__msg("invalid mem access 'scalar'")
>> +__naked void stack_arg_pruning_type_mismatch(void)
>> +{
>> + asm volatile (
>> + "call %[bpf_get_prandom_u32];"
>> + "r6 = r0;"
>> + /* local = 0 on program stack */
>> + "r7 = 0;"
>> + "*(u64 *)(r10 - 8) = r7;"
>> + /* Branch based on random value */
>> + "if r6 s> 3 goto l0_%=;"
>> + /* Path 1: store stack pointer to outgoing arg6 */
>> + "r1 = r10;"
>> + "r1 += -8;"
>> + "*(u64 *)(r11 - 8) = r1;"
>> + "goto l1_%=;"
>> + "l0_%=:"
>> + /* Path 2: store scalar to outgoing arg6 */
>> + "*(u64 *)(r11 - 8) = 42;"
>> + "l1_%=:"
>> + /* Call subprog that dereferences arg6 */
>> + "r1 = r6;"
>> + "r2 = 0;"
>> + "r3 = 0;"
>> + "r4 = 0;"
>> + "r5 = 0;"
>> + "call subprog_deref_arg6;"
>> + "exit;"
>> + :: __imm(bpf_get_prandom_u32)
>> + : __clobber_all
>> + );
>> +}
> Does the error message string match the expected register output?
>
> During v6 review, sashiko-bot raised a concern about test fragility:
> since subprog_deref_arg6 is standard C (not __naked), LLVM determines
> which register is used to dereference f. If a future LLVM version
> chooses a different register, the verifier error will mention that
> register instead of R1, causing the test to fail.
>
> You acknowledged the issue and said you would use a regex like
> __msg("R{{[0-9]}} invalid mem access 'scalar'") to match the register
> dynamically. However, the current code uses __msg("invalid mem access
> 'scalar'") without any register prefix.
>
> The same pattern appears in stack_arg_release_ref,
> stack_arg_stale_pkt_ptr, and stack_arg_null_propagation_fail. Should
> these tests use the regex pattern to avoid compiler-dependent failures,
> or be rewritten to make subprog_deref_arg6 a __naked function?

Yes, I removed the "R{{[0-9]}}' stuff since I thought "R{{[0-9]}}"
will be equivalent to ignore it since we do not have a definite register
any more.

There is an option to use __naked function for subprog_deref_arg6
(see patch "selftests/bpf: Add precision backtracking test for stack arguments").
It becomes more complicated so I prefer the current result.

>
> Reference:
> https://lore.kernel.org/bpf/20260419172100.A89FEC2BCAF@smtp.kernel.org/
>
> [ ... ]
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24902767240